Behavioral task
behavioral1
Sample
0d17420131cbdb7557a4a8f54be7d0d8.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0d17420131cbdb7557a4a8f54be7d0d8.exe
Resource
win10v2004-20231215-en
General
-
Target
0d17420131cbdb7557a4a8f54be7d0d8
-
Size
997KB
-
MD5
0d17420131cbdb7557a4a8f54be7d0d8
-
SHA1
87792432090eaaf456c2a4ecaa1f8cceeeea01ae
-
SHA256
5a6085bd122ece5b0ae9f60738c15cc4dd6570d4cd0ad4ae2274fac43f5e2e92
-
SHA512
19c4be13170eb7994c28e15055505c36e55e8b802655f12cd8325fe037159db2ecff4d057ae71b02ac83e0657a591c170fe5fb41976bb63994687a4e385edea4
-
SSDEEP
24576:3LOIdsGK0Yf6m3cdnlZE0VyKEcSARbgeFKtykI4m:3LpdsGwCQcdjlIISUbgeO
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0d17420131cbdb7557a4a8f54be7d0d8
Files
-
0d17420131cbdb7557a4a8f54be7d0d8.exe windows:5 windows x86 arch:x86
66b84d34a3f55178e9883116d1052592
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
sendto
kernel32
GetVersionExA
EnumResourceNamesA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
advapi32
RegOpenKeyExA
shlwapi
StrStrIA
user32
MessageBoxW
Sections
.text Size: - Virtual size: 176KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 230KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 723KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 995KB - Virtual size: 995KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 152B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 434B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ